Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cursor uploads .env file with secrets despite .gitignore and .cursorignore

forum.cursor.com

Post reply on HN
Print view View original

1–10 of 22 posts

Re: Cursor uploads .env file with secrets despite .gitignore and .cursorignore

#4

Post by anshumankmr »

how can it upload a .env when its there in .gitignore? even if you go and remove the entry of .env from .gitignore, it doesn't start getting tracked right?

but yeah there should be some commit hook that rejects a commit like this for obvious non starters like a .env or credentials.yaml or something (UNLESS the dev explicitly goes and toggles that setting to be off)

Re: Cursor uploads .env file with secrets despite .gitignore and .cursorignore

#5

Post by whbrown »

anshumankmr wrote: post #4

how can it upload a .env when its there in .gitignore? even if you go and remove the entry of .env from .gitignore, it doesn't start getting tracked right? but yeah there should be some commit hook that rejects a commit like this for obvious non starters like a .env or credentials.yaml or something (UNLESS the dev explicitly goes and toggles that setting to be off)

Evidently they simply aren't respecting the .gitignore when choosing which file contents to post to their servers, https://forum.cursor.com/t/env-file-question/60165/9

Regardless of whether it actually makes a commit with the secret, it's still being leaked.

Re: Cursor uploads .env file with secrets despite .gitignore and .cursorignore

#6

Post by Tadpole9181 »

anshumankmr wrote: post #4

how can it upload a .env when its there in .gitignore? even if you go and remove the entry of .env from .gitignore, it doesn't start getting tracked right? but yeah there should be some commit hook that rejects a commit like this for obvious non starters like a .env or credentials.yaml or something (UNLESS the dev explicitly goes and toggles that setting to be off)

This is not about Git, this is about their `.env` contents being sent to an external server for tab complete, even if that file is explicitly marked as "do not use the AI here".
Post reply on HN